Vida CEM swapping

[jamezcab]

First prototype built, just waiting for my SWD programmer to load the bootloader onto the chip.

Once verified it can crack i'm going to work on another version that includes ODB connector and LCD.

hi great work do you have any of these available for sale? or know of anyone who does sell them? thank you i assume a general canbus analyzer could do the same job? but without the pin calculation

[jamezcab]

when i say without pin calculation i mean without automatic pin calculation perhaps a manual method?

[rkam]

In theory you can find the pin manually, but it would take years without any automation.

You must try up to 1000000 combinations of the three first bytes in the pin code, and record the time from request to reply.
One of them will have very small difference in time.
Assuming you have found the three first correct bytes, you try up to 1000000 combinations of the three last bytes until you find the correct ones.

[vtl]

2004 is a brick style CEM. We can't crack it over CAN yet.

[jamezcab]

ahh i see ok thank you for the response i did scan a few pages up to 27 then decided it was time to ask questions thank you for the reply

[vtl]

ahh i see ok thank you for the response i did scan a few pages up to 27 then decided it was time to ask questions thank you for the reply

You may want to solder & program T5Luke's BDM programmer: viewtopic.php?p=609357&hilit=BDM+arduino#p609357 Still need to pull the CEM out, but don't need to cut metal cage and desolder the flash chip (which I still did, but BDM with like 5 wires is way simpler).

[jamezcab]

hi lovely people

do you have connection info for t5 luke method using arduino on p2 cem 2004 xc90

[T5Luke]

You have an REM and not a CEM

[vtl]

FYI, CAN transceiver in original schematics is EOL.

Screenshot at 2023-04-20 11-53-20.png (57.17 KiB) Viewed 547 times

[jamezcab]

my apologies this is a lab rat i ordered. obviously incorrect